Avast vs new Ransomware(Solved)

[BeSecure]

https://youtu.be/PM2eMxgAPgY
Again a fail result for Avast CC.

[Asyn]

VL-Info: Hi, the detection was created. Thank you!

[BeSecure]

@Asyn post:2

VL-Info: Hi, the detection was created. Thank you!

Thanks@Asyn

[Asyn]

You’re welcome.

[BeSecure]

Can you tell me the detection name?@Asyn

[Asyn]

→ https://www.virustotal.com/#/file/9dbd7b3133c9bc80b9ed83712d488d014b856c8814a268871046a30c4b6fc6ae/detection

[BeSecure]

@Asyn post:6

→ https://www.virustotal.com/#/file/9dbd7b3133c9bc80b9ed83712d488d014b856c8814a268871046a30c4b6fc6ae/detection

Thanks again. 8)

[Asyn]

No problem.

[system]

@Asyn post:2

VL-Info: Hi, the detection was created. Thank you!

This is not the point, to “create” a detection AFTER THE FACT. Anyone can do this, including MSE: create a signature once you have the malware “in hand”

The expectation from Avast! is to block the ransomvare using a different mechanism (HIPS, behavior blocker, etc) , not only based on a signature.

[Asyn]

VL-Info: In such tests it is very important to simulate infection vectors correctly, if the guy just copied the executable to desktop and run it, it is not totaly valid test case. Such samples are delivered to system from network, resides in temporal directories etc. Tested executable has standalone behavior same as any tool for mass re-encoding the file for example.

[Evjls]

@Asyn post:10

VL-Info: In such tests it is very important to simulate infection vectors correctly, if the guy just copied the executable to desktop and run it, it is not totaly valid test case. Such samples are delivered to system from network, resides in temporal directories etc. Tested executable has standalone behavior same as any tool for mass re-encoding the file for example.

if the file is copied from a USB or an external HDD, it would yield the same result. Not everyone downloading files from the internet all the time. Why not making CC available for files not downloaded from the browser?

Also, it should be worth mentioned that Windows Defender on windows 10 already has “Controlled folder access” which is quite similar to avast’s “Ransomware Shield”. He demonstrated on another video that WD was bypassed by a ransomware but at least the protected folder is safe

Ransomware shield should be implemented in avast free

[Asyn]

@Evjls post:11

Ransomware shield should be implemented in avast free

You can submit your feedback in “About Avast”.

[BeSecure]

@Evjls post:11

@Asyn post:10

VL-Info: In such tests it is very important to simulate infection vectors correctly, if the guy just copied the executable to desktop and run it, it is not totaly valid test case. Such samples are delivered to system from network, resides in temporal directories etc. Tested executable has standalone behavior same as any tool for mass re-encoding the file for example.

if the file is copied from a USB or an external HDD, it would yield the same result. Not everyone downloading files from the internet all the time. Why not making CC available for files not downloaded from the browser?

Also, it should be worth mentioned that Windows Defender on windows 10 already has “Controlled folder access” which is quite similar to avast’s “Ransomware Shield”. He demonstrated on another video that WD was bypassed by a ransomware but at least the protected folder is safe

Ransomware shield should be implemented in avast free

Agreed.

[system]

@Be Secure post:13

@Evjls post:11

@Asyn post:10

VL-Info: In such tests it is very important to simulate infection vectors correctly, if the guy just copied the executable to desktop and run it, it is not totaly valid test case. Such samples are delivered to system from network, resides in temporal directories etc. Tested executable has standalone behavior same as any tool for mass re-encoding the file for example.

if the file is copied from a USB or an external HDD, it would yield the same result. Not everyone downloading files from the internet all the time. Why not making CC available for files not downloaded from the browser?

Also, it should be worth mentioned that Windows Defender on windows 10 already has “Controlled folder access” which is quite similar to avast’s “Ransomware Shield”. He demonstrated on another video that WD was bypassed by a ransomware but at least the protected folder is safe

Ransomware shield should be implemented in avast free

Agreed.

+1